Technical Information
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\] 'MSSMSGS' = 'rundll32.exe winmpr32.rom,DMIkBQbWWUE'
- %WINDIR%\explorer.exe
- iexplore.exe
- %TEMP%\fig90e7.tmp
- %WINDIR%\syswow64\winmpr32.rom
- %TEMP%\fig90e7.bat
- %TEMP%\fig90e7.tmp
- DNS ASK ob####fseher.net
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'PROGMAN' WindowName: ''
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\fig90E7.bat"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\fig90E7.bat"